Setting Up Azure AD For SharePoint Admins Up Azure AD For SharePoint Admins.pdf•Azure AD Connect...

transcript

10TH ANNUAL CONFERENCE ABOUT MODERN IT TECHNOLOGIES

Setting Up Azure AD For SharePoint Admins

Todd Klindt

• 14 Year SharePoint MVP

• Writer, speaker, podcaster, consultant at Sympraxis Consulting, SysKit Chief Evangelist

todd.klindt@sympraxisconsulting.com@toddklindtwww.toddklindt.comwww.toddklindt.com/Thrive2019

Agenda

• Marketing schlock

• Terminology and Topology

• Syncing a domain for fun and profit

Azure Active Directory

• If you are going to do anything with Office 365 this is step one

• This is a very valuable skill set to add to the resume

• Stop reinventing the authentication wheel

• Be able to speak intelligently to your auth team

• Walk through guide• https://www.youtube.com/watch?v=duYYmqzx0Rc

Identity Bridge

Active Directory

Azure AD Connect(sync + sign on)

Lululemon Story• Azure AD Connect implementation and Self Service

Password Reset (SSPR) migration from the old tool (6 weeks)

• MFA registration, Azure AD conditional access, and Azure AD Identity Protection (7 weeks)

• Microsoft Advanced Threat Analytics (3 weeks)

• Group-based licensing (3 days)

• Azure Information Protection (8 weeks)

• Azure AD Privileged Identity Management (3 days!)

• Countless apps (each in a matter of hours!)

• https://www.toddklindt.com/lululemon

How Azure AD Protects you from leaks• May 2016• 272 million stolen username and passwords• 9.62% of the usernames matched an account• 1.03% had a matching password

• Less than 0.1% of the list had a valid match for username and password

• 58.3% already protected• Of all the accounts in this list, 0.042 % of them were actually at

risk• automated mitigations kick in to protect them

https://www.toddklindt.com/ProtectAAD

Terminology and Topology

Defining Terminology

• (Windows) Active Directory

• User Principal Name (UPN)

• Azure Active Directory (AAD)

• Identity as a Service

• Hybrid

• DirSync

• ADFS

• Azure AD Connect (AADC)

• SSO

• The other SSO

Topology & Security

• ADFS vs DirSync vs Pass-Through• Federation starts with synchronization

• Pass-through, best of both worlds?

• Multifactor Auth• Yours or theirs

• Flip of a switch

Same sign on scenario

Single sign on scenario

Pass-through Auth

Active Directory core concepts and concerns

• FSMO roles, AD DNS, WINS, etc

• Dirty Directories

• 2003 Everyone group -> 2008 Authenticated Users group

• IsCriticalSystemObject objects are not synced• I’m looking at you Domain Users

• UPN issues

• Schema Extensions

On-Prem Server, Cloud Auth

• Azure AD with your on-prem SharePoint Server

• Spence has a session on this here at Thrive• 17:25 - 18:25, Stebrov

Azure AD Connect Walkthrough

Assumptions

• Windows Active Directory Domain• It works

• Forest and Domain Windows 2003 functional level or higher

• Not Single Level or dotted

• AD Connect Server• Windows 2008 or greater

• Own an Internet domain and control DNS

• Have an Azure or Office 365 Tenant

• Domain admin and tenant admin creds

Before Picture

Add Internet Domain

Verify Domain

TXT Record Shuffle

Your DNS Host

Verifying…

The Easy Way

With PowerShell• V1• New-MSOLDomain

• Get-MsolDomainVerificationDns

• Confirm-MsolDomain

• Set-MsolDomain

• V2• New-AzureADDomain

• Get-AzureADDomainVerificationDnsRecord

• Confirm-AzureADDomain

• Set-AzureADDomain

Now, Another Word about DNS

Again with the DNS

Function Check

New Before

Start Syncing

Install and Config

Almost there

The Pudding

Advanced Moves

Viewing AADC

Customizing AADC

miiscient

PowerShell

Security articleAzure AD Connect for Red Teamers

Questions?

Thank you Sponsors#ThriveITconf

Silver

Evening event sponsor

Material

Contact Me

todd.klindt@sympraxisconsulting.com@toddklindtwww.toddklindt.comwww.toddklindt.com/Thrive2019

Setting Up Azure AD For SharePoint Admins Up Azure AD For SharePoint Admins.pdf•Azure AD Connect...

Documents